{
  "finding_id": "DF-3080",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "Unprivileged users can address kernel-internal proc0 (swapper) through /proc/0: atopid('0') returns 0 which slips past the NO_PID guard (vnops.c:798-800) and pfs_pfind(0) special-cases pid 0 to &proc0 (subr.c:285-287). Reproduced as uid 1001: /proc/0/{status,cmdline,rlimit} readable (status shows the swapper row incl. root group list and boot epoch), /proc/0 listed by readdir since proc0 sits on allproc. mem/ctl/regs/map/etype correctly denied. Leaked fields are individually public elsewhere (kern.boottime, kern.cp_time), so the practical delta is negligible — Info-grade namespace/hygiene defect and latent hazard; Linux/FreeBSD never expose pid 0.",
  "exploit_chain": "",
  "evidence": ["run.log: /proc/0 directory listing, swapper status row 'swapper 0 0 0 0 -1,-1 sldr ... 0 0 0,0 -', rlimit lines, '0' present in readdir listing, /proc/0/mem Permission denied (gates hold)"],
  "kernel_refs": ["sys/vfs/procfs/procfs_vnops.c:798", "sys/vfs/procfs/procfs_vnops.c:809", "sys/vfs/procfs/procfs_subr.c:285"],
  "poc_changes": "Written fresh; no seed existed.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 1,
  "guest_dirty": 0,
  "build_cmd": "(shell script, no compile)",
  "run_cmd": "sh procfs_zero.sh",
  "code_hash": "91eef31d1432b6e40dc5b0959480a7e273578fd2aaed3197e11eff17407f68f2",
  "notes": "security.ps_showallprocs=1 on guest (default). With ps_showallprocs=0 the uid gate at vnops.c:809-811 hides /proc/0 from non-root.",
  "recommended_fix": "Reject pid 0 in procfs_lookup's Proot case (pid == NO_PID || pid == 0) and skip p_pid==0 rows in procfs_readdir_root_callback.",
  "fix_status": "not_testable",
  "fix_kernel_uname": "",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against read-only sys/ tree; kernel not rebuilt (Info-grade finding).",
  "fix_evidence": ["fix.diff"]
}